Windows Analysis Report
TeikwYB2tm.exe

Machine Learning detection for sample

Source: Yara match	File source: 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TeikwYB2tm.exe PID: 5056, type: MEMORYSTR

Source: TeikwYB2tm.exe

Joe Sandbox ML: detected

Source: TeikwYB2tm.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49723 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49744 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49714 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49752 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49721 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49720 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49722 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49738 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49747 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49768 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49731 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49763 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49769 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49730 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49713 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49778 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49746 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49776 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49762 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49715 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49785 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49794 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49786 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49777 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49792 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49755 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49771 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49795 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49728 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49753 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49739 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49729 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49787 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49779 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49754 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49737 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49760 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49745 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49784 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49736 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49800 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49802 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49801 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49803 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49793 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49809 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49811 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49817 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49818 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49816 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49808 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49819 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49824 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49825 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49826 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49832 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49833 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49810 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49761 -> 206.206.125.221:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49770 -> 94.131.118.216:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49827 -> 188.132.183.159:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.8:49712 -> 188.132.183.159:443

Source: Joe Sandbox View	ASN Name: PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR
Source: Joe Sandbox View	ASN Name: HYPEENT-SJUS HYPEENT-SJUS
Source: Joe Sandbox View	ASN Name: NASSIST-ASGI NASSIST-ASGI

Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 206.206.125.221
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 94.131.118.216
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159
Source: unknown	TCP traffic detected without corresponding DNS query: 188.132.183.159

Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: TeikwYB2tm.exe, 00000000.00000003.1465191716.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, TeikwYB2tm.exe, 00000000.00000003.1466814303.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: TeikwYB2tm.exe, 00000000.00000003.1464255258.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: TeikwYB2tm.exe, 00000000.00000003.1464255258.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

E-Banking Fraud

Source: Yara match	File source: 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TeikwYB2tm.exe PID: 5056, type: MEMORYSTR

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Process Stats: CPU usage > 49%

Source: TeikwYB2tm.exe

Static PE information: Number of sections : 11 > 10

Source: TeikwYB2tm.exe, 00000000.00000003.1465191716.000000007EB44000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibeay32.dllH vs TeikwYB2tm.exe
Source: TeikwYB2tm.exe, 00000000.00000003.1466814303.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamessleay32.dllH vs TeikwYB2tm.exe

Source: TeikwYB2tm.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal88.troj.evad.winEXE@6/0@0/3

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5272:120:WilError_03

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: TeikwYB2tm.exe

ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\TeikwYB2tm.exe "C:\Users\user\Desktop\TeikwYB2tm.exe"
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value	Jump to behavior

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: ksuser.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: avrt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: audioses.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: midimap.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\InprocServer32

May use the Tor software to hide its network traffic

Source: TeikwYB2tm.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: TeikwYB2tm.exe

Static file information: File size 4277248 > 1048576

Source: TeikwYB2tm.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3eca00

Source: TeikwYB2tm.exe

Static PE information: section name: .didata

Hooking and other Techniques for Hiding and Protection

Source: TeikwYB2tm.exe, 00000000.00000003.1461434686.000000007E870000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE DeviceID=\'c:\'

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Window / User API: threadDelayed 2523			Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Window / User API: threadDelayed 7477			Jump to behavior

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	System information queried: CurrentTimeZoneInformation	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: TeikwYB2tm.exe, 00000000.00000003.2114264563.000000000098B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: TeikwYB2tm.exe, 00000000.00000003.2114264563.000000000098B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Found potential dummy code loops (likely to delay analysis)

Anti Debugging

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Process Stats: CPU usage > 42% for more than 60s

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value			Jump to behavior

Source: TeikwYB2tm.exe, 00000000.00000003.1461434686.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: TeikwYB2tm.exe, 00000000.00000003.1461434686.000000007E870000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\TeikwYB2tm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\TeikwYB2tm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TeikwYB2tm.exe PID: 5056, type: MEMORYSTR

Source: Yara match

File source: Process Memory Space: TeikwYB2tm.exe PID: 5056, type: MEMORYSTR

Remote Access Functionality

Source: Yara match	File source: 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TeikwYB2tm.exe PID: 5056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Multi-hop Proxy	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	142 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
TeikwYB2tm.exe	71%	ReversingLabs	Win32.Trojan.Danabot
TeikwYB2tm.exe	100%	Avira	TR/ATRAPS.Gen
TeikwYB2tm.exe	100%	Joe Sandbox ML

Name	Source	Malicious	Reputation
http://html4/loose.dtd	TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.htmlRAND	TeikwYB2tm.exe, 00000000.00000003.1464255258.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.css	TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/V	TeikwYB2tm.exe, 00000000.00000003.1465191716.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, TeikwYB2tm.exe, 00000000.00000003.1466814303.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.jpg	TeikwYB2tm.exe, 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp	false	high
http://www.openssl.org/support/faq.html	TeikwYB2tm.exe, 00000000.00000003.1464255258.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.132.183.159	unknown	Turkey	42910	PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR	true
206.206.125.221	unknown	United States	13332	HYPEENT-SJUS	true
94.131.118.216	unknown	Ukraine	29632	NASSIST-ASGI	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581418
Start date and time:	2024-12-27 15:09:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TeikwYB2tm.exe renamed because original name is a hash value
Original Sample Name:	72b6b07175ef611ce7daa959a1248aae.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@6/0@0/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: TeikwYB2tm.exe

Simulations

Behavior and APIs

Time	Type	Description
09:10:42	API Interceptor	1x Sleep call for process: WMIC.exe modified
09:11:20	API Interceptor	10139567x Sleep call for process: TeikwYB2tm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
188.132.183.159	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse
188.132.183.159	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse
206.206.125.221	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse
206.206.125.221	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse
94.131.118.216	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse
94.131.118.216	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NASSIST-ASGI	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	94.131.118.216
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	94.131.118.216
	https://reddsuth.outfitsrl.it/?46525SU=4TI90K00D	Get hash	malicious	Unknown	Browse	94.131.117.116
	tmpzNIZ0YQ.exe	Get hash	malicious	ScreenConnect Tool	Browse	95.164.16.15
	H36NgltNe7.exe	Get hash	malicious	ScreenConnect Tool	Browse	95.164.16.15
	lat0Kwfbuj.exe	Get hash	malicious	ScreenConnect Tool	Browse	95.164.16.15
	Josho.m68k.elf	Get hash	malicious	Unknown	Browse	95.164.4.65
	J5uGzpvcAa.elf	Get hash	malicious	Unknown	Browse	95.164.4.65
	nPRmTlXhOT.elf	Get hash	malicious	Unknown	Browse	95.164.4.65
	OwBugJ5CiC.elf	Get hash	malicious	Unknown	Browse	95.164.4.65
HYPEENT-SJUS	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	206.206.125.221
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	206.206.125.221
	YvITZPUmfd.ps1	Get hash	malicious	Unknown	Browse	206.206.127.152
	K05MQ5BcC8.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
	eQwUFcwrXk.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
	4YgQ2xN41W.lnk	Get hash	malicious	RDPWrap Tool, Ducktail	Browse	206.206.126.252
	EERNI7eIS7.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
	cOOhDuNWt7.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
	O5PR3i6ILA.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
	SPENDINGONDIGITALMARKETING_DIGITALMARKETINGBUDGET lnk.lnk	Get hash	malicious	Ducktail	Browse	206.206.126.252
PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR	A4FY1OA97K.lnk	Get hash	malicious	DanaBot	Browse	188.132.183.159
	vreFmptfUu.lnk	Get hash	malicious	DanaBot	Browse	188.132.183.159
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	78.135.74.199
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	78.135.115.141
	PO_63738373663838____________________________________________________________________________.exe	Get hash	malicious	Snake Keylogger	Browse	188.132.193.46
	File07098.PDF.exe	Get hash	malicious	Snake Keylogger	Browse	188.132.193.46
	Scan_20241030.vbs	Get hash	malicious	FormBook, GuLoader	Browse	46.28.239.165
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.132.193.46
	nabm68k.elf	Get hash	malicious	Unknown	Browse	188.132.241.224
	dekont_001.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.132.193.46

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.796835542143392
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	TeikwYB2tm.exe
File size:	4'277'248 bytes
MD5:	72b6b07175ef611ce7daa959a1248aae
SHA1:	bee9d33d83c98a7c2c3c9d0eb671fa1d53328378
SHA256:	8e6ae3b356d2205296fec0761daa461a311190e50e0e611699ebb4aad6e6cd77
SHA512:	56f0ee5ba99a55f05bfea0252b544d6dcac6cc22dbf430e228babd1520a14ea76429fcc8f67bcc0425f8d573211a1d1b47ba6164c136d8c2a85a26030cae9f52
SSDEEP:	98304:h+Dc6yHfpXZa1ZUVTZ2zsFi840WiRoYIUF4ZxStM3bQR:w9ylZIUVt2zd8rnH4jStM3bg
TLSH:	C016F122F64C667EE19F0E3A5477B590993F77A2A996DC1B47F00848CF358C0263A64F
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x7eee00
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x676939AA [Mon Dec 23 10:21:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	29e05b1fea10173c5bcc5ba6150988ec

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFE4h
xor eax, eax
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-18h], eax
mov eax, 007EA0C0h
call 00007FB32C961C1Dh
xor eax, eax
push ebp
push 007EEF1Dh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
call 00007FB32CD3AB7Eh
cmp eax, 000000FAh
jnl 00007FB32CD40612h
call 00007FB32CD3ABCAh
cmp eax, 78h
jnl 00007FB32CD40604h
mov dword ptr [007FCFA0h], 00000001h
mov dword ptr [007FCF9Ch], 001DBCD7h
mov eax, dword ptr [007FCF9Ch]
mov dword ptr [007FCFA4h], eax
mov eax, dword ptr [007FCF9Ch]
test eax, eax
jl 00007FB32CD4056Eh
inc eax
mov dword ptr [ebp-14h], eax
mov dword ptr [007FCF98h], 00000000h
inc dword ptr [007FCFA0h]
dec dword ptr [007FCFA4h]
push 00000000h
call 00007FB32C979C19h
inc dword ptr [007FCF98h]
dec dword ptr [ebp-14h]
jne 00007FB32CD40524h
cmp dword ptr [007FCFA4h], FFFFFFFFh
jne 00007FB32CD405A4h
lea edx, dword ptr [ebp-18h]
mov ax, 0063h
call 00007FB32CD3AEA5h
mov eax, dword ptr [ebp-18h]
mov edx, 007EEF38h
call 00007FB32C95C14Ch
je 00007FB32CD40589h
call 00007FB32CD3B0E5h
cmp eax, 0Ah
jbe 00007FB32CD4057Fh
call 00007FB32CD4B0FBh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x400000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3fd000	0x16c6	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x41d000	0x3600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x403000	0x191bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x402000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3fd4cc	0x364	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3ff000	0x278	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3ec91c	0x3eca00	8a51d5ea5128862e1a11e09561809d2b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x3ee000	0xf50	0x1000	3ff4032e721470ab7fd9881c45fc2fa7	False	0.55859375	data	6.1659912557301615	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x3ef000	0x7d68	0x7e00	76a1a3204a87221df8dd865bb47ca72b	False	0.5639880952380952	data	6.352731899166621	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x3f7000	0x5fac	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x3fd000	0x16c6	0x1800	f83dfbc7a8d8169726b5b3aba8787951	False	0.3240559895833333	data	4.895786587173563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x3ff000	0x278	0x400	7a0cace727c21d6b42ac476919254aa3	False	0.26953125	firmware 100 v0 (revision 2733719296) X\361? , version 54304.16640.10270 (region 2297446144), 0 bytes or less, UNKNOWN1 0x88f03f00, at 0 0 bytes , at 0 0 bytes , at 0x60524000 3629203456 bytes	2.7239518130953684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x400000	0x9a	0x200	a0c88ba38b9aab7813e23cf8cd967014	False	0.251953125	data	1.7841898411372727	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x401000	0x20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x402000	0x5c	0x200	610e9cb9d596ddf3f8481c9e9885e5fe	False	0.1875	data	1.343433641850296	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x403000	0x191bc	0x19200	d5512eb7671fdcd3f815b8d69f577e2c	False	0.5867828824626866	data	6.708593676418638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x41d000	0x3600	0x3600	4125734278c336b919f44073caff1eb1	False	0.2890625	data	3.700113224189507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_STRING	0x41d368	0x4e0	data	0.3333333333333333
RT_STRING	0x41d848	0x310	data	0.35331632653061223
RT_STRING	0x41db58	0x330	data	0.39215686274509803
RT_STRING	0x41de88	0x4c4	data	0.3983606557377049
RT_STRING	0x41e34c	0x4ac	data	0.32274247491638797
RT_STRING	0x41e7f8	0x3b4	data	0.3628691983122363
RT_STRING	0x41ebac	0x440	data	0.38235294117647056
RT_STRING	0x41efec	0x21c	data	0.40555555555555556
RT_STRING	0x41f208	0xbc	data	0.6542553191489362
RT_STRING	0x41f2c4	0x100	data	0.62890625
RT_STRING	0x41f3c4	0x338	data	0.4223300970873786
RT_STRING	0x41f6fc	0x478	data	0.29895104895104896
RT_STRING	0x41fb74	0x354	data	0.4107981220657277
RT_STRING	0x41fec8	0x2b8	data	0.4367816091954023
RT_RCDATA	0x420180	0x10	data	1.5
RT_RCDATA	0x420190	0x3a4	data	0.6030042918454935

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	CreateWindowExW, UpdateWindow, TranslateMessage, SystemParametersInfoW, ShowWindow, RegisterClassW, PeekMessageW, MsgWaitForMultipleObjects, MessageBoxW, LoadStringW, GetSystemMetrics, GetMessageW, EndPaint, DispatchMessageW, DefWindowProcW, CharUpperBuffW, CharUpperW, CharLowerBuffW, BeginPaint
gdi32.dll	SetBkColor, Rectangle
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	WriteFile, WideCharToMultiByte, WaitForSingleObject, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, SwitchToThread, SuspendThread, Sleep, SetThreadPriority, SetLastError, SetFileTime, SetFilePointer, SetEvent, SetEndOfFile, ResumeThread, ResetEvent, ReleaseSemaphore, ReadFile, RaiseException, QueryDosDeviceW, IsDebuggerPresent, MapViewOfFile, LocalFree, LoadLibraryA, LoadLibraryW, LeaveCriticalSection, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GetVolumeInformationW, GetVersionExW, GetTimeZoneInformation, GetTickCount64, GetTickCount, GetThreadPriority, GetThreadLocale, GetSystemInfo, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetLogicalDrives, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeThread, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcess, GetCPInfoExW, GetCPInfo, GetACP, FreeLibrary, FormatMessageW, FlushInstructionCache, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitProcess, EnumSystemLocalesW, EnumCalendarInfoW, EnterCriticalSection, DeleteCriticalSection, CreateSemaphoreA, CreateProcessW, CreatePipe, CreateFileMappingW, CreateFileW, CreateEventA, CreateEventW, CreateDirectoryW, CompareStringW, CloseHandle
kernel32.dll	Sleep
netapi32.dll	NetApiBufferFree, NetWkstaGetInfo
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
msvcrt.dll	memset, memmove, memcpy
msvcrt.dll	_beginthreadex
winmm.dll	waveOutGetVolume

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x782574
__dbk_fcall_wrapper	2	0x4103c4
dbkFCallWrapperAddr	1	0x7fa630

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T15:11:38.439939+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49712	188.132.183.159	443	TCP
2024-12-27T15:11:39.545312+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49713	206.206.125.221	443	TCP
2024-12-27T15:11:40.637354+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49714	94.131.118.216	443	TCP
2024-12-27T15:11:41.729984+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49715	188.132.183.159	443	TCP
2024-12-27T15:11:50.295368+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49720	188.132.183.159	443	TCP
2024-12-27T15:11:51.643029+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49721	206.206.125.221	443	TCP
2024-12-27T15:11:52.720274+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49722	94.131.118.216	443	TCP
2024-12-27T15:11:53.788416+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49723	188.132.183.159	443	TCP
2024-12-27T15:11:59.247822+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49728	188.132.183.159	443	TCP
2024-12-27T15:11:59.304584+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49729	206.206.125.221	443	TCP
2024-12-27T15:11:59.417278+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49730	94.131.118.216	443	TCP
2024-12-27T15:11:59.510055+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49731	188.132.183.159	443	TCP
2024-12-27T15:12:11.122462+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49736	188.132.183.159	443	TCP
2024-12-27T15:12:12.709862+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49737	206.206.125.221	443	TCP
2024-12-27T15:12:14.448083+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49738	94.131.118.216	443	TCP
2024-12-27T15:12:16.448381+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49739	188.132.183.159	443	TCP
2024-12-27T15:12:19.640486+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49744	188.132.183.159	443	TCP
2024-12-27T15:12:21.191563+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49745	206.206.125.221	443	TCP
2024-12-27T15:12:23.616652+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49746	94.131.118.216	443	TCP
2024-12-27T15:12:26.161750+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49747	188.132.183.159	443	TCP
2024-12-27T15:12:37.492107+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49752	188.132.183.159	443	TCP
2024-12-27T15:12:37.622136+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49753	206.206.125.221	443	TCP
2024-12-27T15:12:37.712359+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49754	94.131.118.216	443	TCP
2024-12-27T15:12:37.815336+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49755	188.132.183.159	443	TCP
2024-12-27T15:12:51.082407+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49760	188.132.183.159	443	TCP
2024-12-27T15:12:53.076578+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49761	206.206.125.221	443	TCP
2024-12-27T15:12:55.344119+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49762	94.131.118.216	443	TCP
2024-12-27T15:12:57.786175+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49763	188.132.183.159	443	TCP
2024-12-27T15:13:01.708012+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49768	188.132.183.159	443	TCP
2024-12-27T15:13:04.458407+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49769	206.206.125.221	443	TCP
2024-12-27T15:13:06.473593+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49770	94.131.118.216	443	TCP
2024-12-27T15:13:09.265715+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49771	188.132.183.159	443	TCP
2024-12-27T15:13:22.878253+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49776	188.132.183.159	443	TCP
2024-12-27T15:13:22.997258+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49777	206.206.125.221	443	TCP
2024-12-27T15:13:23.126605+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49778	94.131.118.216	443	TCP
2024-12-27T15:13:23.244691+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49779	188.132.183.159	443	TCP
2024-12-27T15:13:37.423747+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49784	188.132.183.159	443	TCP
2024-12-27T15:13:40.790371+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49785	206.206.125.221	443	TCP
2024-12-27T15:13:43.518181+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49786	94.131.118.216	443	TCP
2024-12-27T15:13:46.225598+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49787	188.132.183.159	443	TCP
2024-12-27T15:13:50.162548+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49792	188.132.183.159	443	TCP
2024-12-27T15:13:53.255486+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49793	206.206.125.221	443	TCP
2024-12-27T15:13:56.446945+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49794	94.131.118.216	443	TCP
2024-12-27T15:14:00.609758+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49795	188.132.183.159	443	TCP
2024-12-27T15:14:14.394622+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49800	188.132.183.159	443	TCP
2024-12-27T15:14:14.457176+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49801	206.206.125.221	443	TCP
2024-12-27T15:14:14.522655+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49802	94.131.118.216	443	TCP
2024-12-27T15:14:14.586618+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49803	188.132.183.159	443	TCP
2024-12-27T15:14:22.152927+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49808	188.132.183.159	443	TCP
2024-12-27T15:14:23.229408+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49809	206.206.125.221	443	TCP
2024-12-27T15:14:24.310652+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49810	94.131.118.216	443	TCP
2024-12-27T15:14:25.397671+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49811	188.132.183.159	443	TCP
2024-12-27T15:14:27.771287+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49816	188.132.183.159	443	TCP
2024-12-27T15:14:28.864984+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49817	206.206.125.221	443	TCP
2024-12-27T15:14:30.031928+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49818	94.131.118.216	443	TCP
2024-12-27T15:14:31.113342+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49819	188.132.183.159	443	TCP
2024-12-27T15:14:36.568558+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49824	188.132.183.159	443	TCP
2024-12-27T15:14:36.617226+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49825	206.206.125.221	443	TCP
2024-12-27T15:14:37.705535+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49826	94.131.118.216	443	TCP
2024-12-27T15:14:37.750731+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49827	188.132.183.159	443	TCP
2024-12-27T15:14:45.236367+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49832	188.132.183.159	443	TCP
2024-12-27T15:14:46.361209+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.8	49833	206.206.125.221	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 15:10:46.871047974 CET	49706	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:46.871105909 CET	443	49706	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:46.871174097 CET	49706	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:47.084862947 CET	49706	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:47.084902048 CET	443	49706	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:47.084927082 CET	49706	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:47.084935904 CET	443	49706	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:47.084955931 CET	443	49706	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:48.110546112 CET	49707	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:10:48.110579014 CET	443	49707	206.206.125.221	192.168.2.8
Dec 27, 2024 15:10:48.110650063 CET	49707	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:10:48.183244944 CET	49707	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:10:48.183258057 CET	443	49707	206.206.125.221	192.168.2.8
Dec 27, 2024 15:10:48.183326006 CET	49707	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:10:48.183336020 CET	443	49707	206.206.125.221	192.168.2.8
Dec 27, 2024 15:10:48.183341980 CET	443	49707	206.206.125.221	192.168.2.8
Dec 27, 2024 15:10:49.203722000 CET	49708	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:10:49.203749895 CET	443	49708	94.131.118.216	192.168.2.8
Dec 27, 2024 15:10:49.203867912 CET	49708	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:10:49.276696920 CET	49708	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:10:49.276706934 CET	443	49708	94.131.118.216	192.168.2.8
Dec 27, 2024 15:10:49.276779890 CET	443	49708	94.131.118.216	192.168.2.8
Dec 27, 2024 15:10:50.297434092 CET	49709	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:50.297543049 CET	443	49709	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:50.297641993 CET	49709	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:50.394860029 CET	49709	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:50.394886017 CET	443	49709	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:50.394926071 CET	443	49709	188.132.183.159	192.168.2.8
Dec 27, 2024 15:10:50.394937038 CET	49709	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:10:50.394953012 CET	443	49709	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:38.344546080 CET	49712	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:38.344646931 CET	443	49712	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:38.344772100 CET	49712	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:38.439939022 CET	49712	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:38.439987898 CET	443	49712	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:38.440052986 CET	49712	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:38.440054893 CET	443	49712	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:38.440078020 CET	443	49712	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:39.456002951 CET	49713	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:39.456038952 CET	443	49713	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:39.456145048 CET	49713	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:39.545311928 CET	49713	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:39.545334101 CET	443	49713	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:39.545376062 CET	49713	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:39.545382023 CET	443	49713	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:39.545402050 CET	443	49713	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:40.563921928 CET	49714	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:40.563997030 CET	443	49714	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:40.564089060 CET	49714	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:40.637353897 CET	49714	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:40.637413979 CET	443	49714	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:40.637486935 CET	49714	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:40.637491941 CET	443	49714	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:40.637509108 CET	443	49714	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:41.656941891 CET	49715	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.657068014 CET	443	49715	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.657171011 CET	49715	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.729984045 CET	49715	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.730025053 CET	443	49715	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.730084896 CET	443	49715	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.730092049 CET	49715	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.730109930 CET	443	49715	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.738156080 CET	49716	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.738199949 CET	443	49716	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.738276005 CET	49716	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.816231012 CET	49716	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.816286087 CET	443	49716	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.816342115 CET	443	49716	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.816343069 CET	49716	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:41.816361904 CET	443	49716	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:41.824831009 CET	49717	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:41.824882984 CET	443	49717	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:41.824959993 CET	49717	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:41.900969028 CET	49717	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:41.901000977 CET	443	49717	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:41.901061058 CET	443	49717	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:41.901062965 CET	49717	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:41.901079893 CET	443	49717	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:41.909260035 CET	49718	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:41.909291029 CET	443	49718	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:41.909358978 CET	49718	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:41.994128942 CET	49718	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:41.994151115 CET	443	49718	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:41.994199991 CET	49718	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:41.994204044 CET	443	49718	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:41.994215965 CET	443	49718	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:42.002059937 CET	49719	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:42.002085924 CET	443	49719	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:42.002170086 CET	49719	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:42.068464041 CET	49719	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:42.068494081 CET	443	49719	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:42.068552017 CET	443	49719	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:42.068559885 CET	49719	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:42.068576097 CET	443	49719	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:50.187979937 CET	49720	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:50.188082933 CET	443	49720	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:50.188183069 CET	49720	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:50.295367956 CET	49720	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:50.295398951 CET	443	49720	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:50.295448065 CET	49720	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:50.295449972 CET	443	49720	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:50.295461893 CET	443	49720	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:51.547374010 CET	49721	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:51.547468901 CET	443	49721	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:51.547554970 CET	49721	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:51.643028975 CET	49721	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:51.643079042 CET	443	49721	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:51.643142939 CET	443	49721	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:51.643143892 CET	49721	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:51.643172979 CET	443	49721	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:52.656857014 CET	49722	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:52.656933069 CET	443	49722	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:52.657013893 CET	49722	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:52.720273972 CET	49722	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:52.720298052 CET	443	49722	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:52.720374107 CET	443	49722	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:52.720390081 CET	49722	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:52.720408916 CET	443	49722	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:53.735132933 CET	49723	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:53.735169888 CET	443	49723	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:53.735260010 CET	49723	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:53.788415909 CET	49723	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:53.788431883 CET	443	49723	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:53.788477898 CET	49723	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:53.788486958 CET	443	49723	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:53.788494110 CET	443	49723	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:55.819842100 CET	49724	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:55.819904089 CET	443	49724	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:55.819972038 CET	49724	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:55.878185987 CET	49724	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:55.878230095 CET	443	49724	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:55.878261089 CET	49724	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:55.878268957 CET	443	49724	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:55.878335953 CET	443	49724	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:56.891927004 CET	49725	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:56.891992092 CET	443	49725	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:56.892163038 CET	49725	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:56.967056036 CET	49725	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:56.967093945 CET	443	49725	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:56.967160940 CET	443	49725	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:57.994299889 CET	49726	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:57.994357109 CET	443	49726	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:57.999130964 CET	49726	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:58.087342978 CET	49726	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:58.087369919 CET	443	49726	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:58.087438107 CET	443	49726	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:59.112905025 CET	49727	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.112961054 CET	443	49727	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.113018990 CET	49727	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.185065031 CET	49727	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.185096025 CET	443	49727	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.185144901 CET	49727	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.185146093 CET	443	49727	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.185163021 CET	443	49727	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.195642948 CET	49728	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.195699930 CET	443	49728	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.195758104 CET	49728	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.247822046 CET	49728	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.247853994 CET	443	49728	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.247886896 CET	443	49728	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.247898102 CET	49728	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.247914076 CET	443	49728	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.255889893 CET	49729	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:59.255934000 CET	443	49729	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:59.255999088 CET	49729	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:59.304584026 CET	49729	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:59.304606915 CET	443	49729	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:59.304646969 CET	49729	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:11:59.304653883 CET	443	49729	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:59.304665089 CET	443	49729	206.206.125.221	192.168.2.8
Dec 27, 2024 15:11:59.313692093 CET	49730	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:59.313760996 CET	443	49730	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:59.313827991 CET	49730	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:59.417278051 CET	49730	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:59.417309999 CET	443	49730	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:59.417356014 CET	49730	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:11:59.417370081 CET	443	49730	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:59.417367935 CET	443	49730	94.131.118.216	192.168.2.8
Dec 27, 2024 15:11:59.432146072 CET	49731	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.432199001 CET	443	49731	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.432255030 CET	49731	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.510055065 CET	49731	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.510076046 CET	443	49731	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.510117054 CET	49731	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:11:59.510123968 CET	443	49731	188.132.183.159	192.168.2.8
Dec 27, 2024 15:11:59.510148048 CET	443	49731	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:01.578207016 CET	49732	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:01.578253031 CET	443	49732	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:01.578310013 CET	49732	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:01.726521969 CET	49732	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:01.726541996 CET	443	49732	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:01.726583004 CET	49732	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:01.726596117 CET	443	49732	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:01.726604939 CET	443	49732	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:03.672590017 CET	49733	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:03.672658920 CET	443	49733	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:03.672749043 CET	49733	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:03.736723900 CET	49733	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:03.736785889 CET	443	49733	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:03.736849070 CET	443	49733	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:03.736860991 CET	49733	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:03.736886024 CET	443	49733	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:06.036439896 CET	49734	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:06.036493063 CET	443	49734	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:06.036649942 CET	49734	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:06.346194029 CET	49734	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:06.346194983 CET	49734	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:06.346220016 CET	443	49734	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:06.346234083 CET	443	49734	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:06.346271038 CET	443	49734	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:08.219341040 CET	49735	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:08.219376087 CET	443	49735	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:08.219578981 CET	49735	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:08.279418945 CET	49735	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:08.279445887 CET	443	49735	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:08.279571056 CET	49735	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:08.279587030 CET	443	49735	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:08.279592991 CET	443	49735	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:11.032191992 CET	49736	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:11.032241106 CET	443	49736	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:11.032325029 CET	49736	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:11.122462034 CET	49736	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:11.122484922 CET	443	49736	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:11.122540951 CET	49736	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:11.122548103 CET	443	49736	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:11.122575045 CET	443	49736	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:12.657624960 CET	49737	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:12.657661915 CET	443	49737	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:12.658096075 CET	49737	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:12.709861994 CET	49737	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:12.709896088 CET	443	49737	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:12.709933996 CET	443	49737	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:14.392524004 CET	49738	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:14.392580032 CET	443	49738	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:14.392914057 CET	49738	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:14.448082924 CET	49738	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:14.448108912 CET	443	49738	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:14.448179960 CET	443	49738	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:16.354317904 CET	49739	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:16.354366064 CET	443	49739	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:16.354567051 CET	49739	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:16.448380947 CET	49739	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:16.448395014 CET	443	49739	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:16.448432922 CET	443	49739	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:16.448462009 CET	49739	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:16.448472023 CET	443	49739	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.172939062 CET	49740	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.173055887 CET	443	49740	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.173131943 CET	49740	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.269588947 CET	49740	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.269645929 CET	443	49740	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.269706011 CET	49740	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.269711018 CET	443	49740	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.269732952 CET	443	49740	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.283860922 CET	49741	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:17.283906937 CET	443	49741	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:17.283972025 CET	49741	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:17.377140999 CET	49741	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:17.377156973 CET	443	49741	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:17.377219915 CET	443	49741	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:17.380052090 CET	49742	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:17.380096912 CET	443	49742	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:17.380162001 CET	49742	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:17.446515083 CET	49742	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:17.446530104 CET	443	49742	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:17.446569920 CET	443	49742	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:17.446578979 CET	49742	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:17.446592093 CET	443	49742	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:17.458885908 CET	49743	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.458992958 CET	443	49743	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.459079027 CET	49743	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.532718897 CET	49743	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.532742023 CET	443	49743	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.532802105 CET	443	49743	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:17.532807112 CET	49743	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:17.532824039 CET	443	49743	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:19.578972101 CET	49744	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:19.579036951 CET	443	49744	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:19.579123020 CET	49744	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:19.640486002 CET	49744	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:19.640508890 CET	443	49744	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:19.640568018 CET	443	49744	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:19.640578985 CET	49744	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:19.640594006 CET	443	49744	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:20.902745008 CET	49745	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:20.902803898 CET	443	49745	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:20.902889013 CET	49745	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:21.191562891 CET	49745	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:21.191591024 CET	443	49745	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:21.191642046 CET	49745	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:21.191648960 CET	443	49745	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:21.191679955 CET	443	49745	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:23.547468901 CET	49746	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:23.547513962 CET	443	49746	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:23.547595024 CET	49746	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:23.616652012 CET	49746	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:23.616671085 CET	443	49746	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:23.616724968 CET	443	49746	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:23.616731882 CET	49746	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:23.616749048 CET	443	49746	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:26.019608974 CET	49747	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:26.019654036 CET	443	49747	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:26.019851923 CET	49747	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:26.161750078 CET	49747	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:26.161786079 CET	443	49747	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:26.161849022 CET	49747	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:26.161849976 CET	443	49747	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:26.161864996 CET	443	49747	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:29.424411058 CET	49748	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:29.424468994 CET	443	49748	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:29.424706936 CET	49748	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:29.609473944 CET	49748	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:29.609500885 CET	443	49748	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:29.609546900 CET	49748	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:29.609556913 CET	443	49748	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:29.609575987 CET	443	49748	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:32.283519983 CET	49749	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:32.283562899 CET	443	49749	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:32.283627987 CET	49749	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:32.372744083 CET	49749	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:32.372766018 CET	443	49749	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:32.372809887 CET	49749	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:32.372826099 CET	443	49749	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:32.372833967 CET	443	49749	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:34.157205105 CET	49750	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:34.157238960 CET	443	49750	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:34.157315016 CET	49750	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:34.286838055 CET	49750	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:34.286859035 CET	443	49750	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:34.286920071 CET	49750	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:34.286921024 CET	443	49750	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:34.286935091 CET	443	49750	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:35.985173941 CET	49751	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:35.985228062 CET	443	49751	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:35.985292912 CET	49751	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:36.277144909 CET	49751	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:36.277182102 CET	443	49751	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:36.277199984 CET	49751	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:36.277208090 CET	443	49751	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:36.277249098 CET	443	49751	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.232448101 CET	49752	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.232507944 CET	443	49752	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.232701063 CET	49752	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.492106915 CET	49752	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.492124081 CET	443	49752	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.492199898 CET	443	49752	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.516849995 CET	49753	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:37.516891956 CET	443	49753	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:37.516972065 CET	49753	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:37.622136116 CET	49753	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:37.622173071 CET	443	49753	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:37.622241974 CET	443	49753	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:37.622256994 CET	49753	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:37.622276068 CET	443	49753	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:37.656048059 CET	49754	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:37.656107903 CET	443	49754	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:37.656423092 CET	49754	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:37.712358952 CET	49754	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:37.712393045 CET	443	49754	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:37.712445974 CET	443	49754	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:37.742356062 CET	49755	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.742379904 CET	443	49755	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.746406078 CET	49755	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.815335989 CET	49755	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.815347910 CET	443	49755	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.815387964 CET	443	49755	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:37.815431118 CET	49755	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:37.815439939 CET	443	49755	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:39.863694906 CET	49756	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:39.863732100 CET	443	49756	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:39.863822937 CET	49756	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:39.946332932 CET	49756	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:39.946348906 CET	443	49756	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:39.946423054 CET	443	49756	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:41.547533035 CET	49757	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:41.547571898 CET	443	49757	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:41.547713995 CET	49757	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:42.946996927 CET	49757	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:42.947025061 CET	443	49757	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:42.947067976 CET	49757	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:42.947071075 CET	443	49757	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:42.947083950 CET	443	49757	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:44.633383989 CET	49758	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:44.633423090 CET	443	49758	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:44.633497000 CET	49758	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:44.683825016 CET	49758	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:44.683825016 CET	49758	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:44.683851957 CET	443	49758	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:44.683860064 CET	443	49758	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:44.683912039 CET	443	49758	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:47.344152927 CET	49759	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:47.344193935 CET	443	49759	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:47.344247103 CET	49759	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:47.453843117 CET	49759	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:47.453857899 CET	443	49759	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:47.453893900 CET	443	49759	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:47.453929901 CET	49759	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:47.453943014 CET	443	49759	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:51.001822948 CET	49760	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:51.001877069 CET	443	49760	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:51.004652023 CET	49760	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:51.082406998 CET	49760	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:51.082422018 CET	443	49760	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:51.082458019 CET	49760	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:51.082467079 CET	443	49760	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:52.954360962 CET	49761	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:52.954407930 CET	443	49761	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:52.958451033 CET	49761	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:53.076577902 CET	49761	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:53.076617956 CET	443	49761	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:53.076666117 CET	49761	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:53.076682091 CET	443	49761	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:53.076684952 CET	443	49761	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:54.929826975 CET	49762	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:54.929883003 CET	443	49762	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:54.930001974 CET	49762	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:55.344119072 CET	49762	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:55.344140053 CET	443	49762	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:55.344187021 CET	49762	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:55.344193935 CET	443	49762	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:55.344240904 CET	443	49762	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:57.626908064 CET	49763	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:57.626955986 CET	443	49763	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:57.627017021 CET	49763	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:57.786175013 CET	49763	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:57.786211014 CET	443	49763	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:57.786267996 CET	49763	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:57.786272049 CET	443	49763	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:57.786284924 CET	443	49763	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.267765045 CET	49764	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.267832994 CET	443	49764	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.267915010 CET	49764	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.388457060 CET	49764	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.388492107 CET	443	49764	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.388537884 CET	49764	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.388542891 CET	443	49764	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.388638973 CET	443	49764	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.403283119 CET	49765	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:59.403331995 CET	443	49765	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:59.403389931 CET	49765	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:59.469671965 CET	49765	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:59.469692945 CET	443	49765	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:59.469738007 CET	49765	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:12:59.469743967 CET	443	49765	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:59.469773054 CET	443	49765	206.206.125.221	192.168.2.8
Dec 27, 2024 15:12:59.480302095 CET	49766	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:59.480360031 CET	443	49766	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:59.480437994 CET	49766	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:59.534198046 CET	49766	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:59.534241915 CET	443	49766	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:59.534293890 CET	49766	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:12:59.534297943 CET	443	49766	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:59.534313917 CET	443	49766	94.131.118.216	192.168.2.8
Dec 27, 2024 15:12:59.545061111 CET	49767	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.545109034 CET	443	49767	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.545186996 CET	49767	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.610701084 CET	49767	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.610737085 CET	443	49767	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.610816956 CET	49767	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:12:59.610816956 CET	443	49767	188.132.183.159	192.168.2.8
Dec 27, 2024 15:12:59.610836983 CET	443	49767	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:01.641066074 CET	49768	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:01.641112089 CET	443	49768	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:01.641182899 CET	49768	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:01.708012104 CET	49768	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:01.708043098 CET	443	49768	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:01.708093882 CET	49768	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:01.708101034 CET	443	49768	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:01.708134890 CET	443	49768	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:03.693280935 CET	49769	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:03.693334103 CET	443	49769	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:03.693396091 CET	49769	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:04.458406925 CET	49769	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:04.458447933 CET	443	49769	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:04.458523989 CET	443	49769	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:06.398400068 CET	49770	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:06.398468018 CET	443	49770	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:06.398542881 CET	49770	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:06.473592997 CET	49770	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:06.473628998 CET	443	49770	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:06.473678112 CET	443	49770	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:06.473711014 CET	49770	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:06.473728895 CET	443	49770	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:09.112490892 CET	49771	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:09.112524986 CET	443	49771	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:09.112590075 CET	49771	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:09.265714884 CET	49771	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:09.265738964 CET	443	49771	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:09.265782118 CET	49771	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:09.265795946 CET	443	49771	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:12.886421919 CET	49772	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:12.886460066 CET	443	49772	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:12.887432098 CET	49772	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:13.222393036 CET	49772	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:13.222412109 CET	443	49772	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:13.222455025 CET	49772	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:13.222455978 CET	443	49772	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:13.222470045 CET	443	49772	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:15.439016104 CET	49773	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:15.439060926 CET	443	49773	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:15.439121008 CET	49773	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:15.576927900 CET	49773	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:15.576956034 CET	443	49773	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:15.576996088 CET	49773	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:15.577001095 CET	443	49773	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:15.577013016 CET	443	49773	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:17.657227993 CET	49774	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:17.657280922 CET	443	49774	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:17.657360077 CET	49774	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:17.730782032 CET	49774	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:17.730825901 CET	443	49774	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:17.730849028 CET	49774	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:17.730860949 CET	443	49774	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:17.730890036 CET	443	49774	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:20.016299009 CET	49775	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:20.016376019 CET	443	49775	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:20.016498089 CET	49775	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:20.681406021 CET	49775	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:20.681452990 CET	443	49775	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:20.681513071 CET	443	49775	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:20.681557894 CET	49775	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:20.681574106 CET	443	49775	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:22.536746025 CET	49776	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:22.536763906 CET	443	49776	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:22.537053108 CET	49776	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:22.878252983 CET	49776	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:22.878278971 CET	443	49776	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:22.878339052 CET	443	49776	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:22.878350019 CET	49776	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:22.878365993 CET	443	49776	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:22.891730070 CET	49777	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:22.891782999 CET	443	49777	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:22.891896963 CET	49777	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:22.997257948 CET	49777	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:22.997283936 CET	443	49777	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:22.997335911 CET	443	49777	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:22.997379065 CET	49777	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:22.997395039 CET	443	49777	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:23.008007050 CET	49778	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:23.008057117 CET	443	49778	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:23.008207083 CET	49778	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:23.126605034 CET	49778	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:23.126635075 CET	443	49778	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:23.126687050 CET	49778	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:23.126693010 CET	443	49778	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:23.126704931 CET	443	49778	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:23.139414072 CET	49779	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:23.139456987 CET	443	49779	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:23.139566898 CET	49779	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:23.244690895 CET	49779	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:23.244715929 CET	443	49779	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:23.244755030 CET	49779	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:23.244761944 CET	443	49779	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:23.244786024 CET	443	49779	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:25.282757998 CET	49780	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:25.282798052 CET	443	49780	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:25.282855034 CET	49780	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:25.371756077 CET	49780	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:25.371787071 CET	443	49780	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:25.371803045 CET	49780	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:25.371810913 CET	443	49780	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:25.371840954 CET	443	49780	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:28.086615086 CET	49781	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:28.086673021 CET	443	49781	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:28.086793900 CET	49781	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:28.178905964 CET	49781	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:28.178934097 CET	443	49781	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:28.178947926 CET	49781	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:28.178952932 CET	443	49781	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:28.178994894 CET	443	49781	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:30.376885891 CET	49782	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:30.376943111 CET	443	49782	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:30.377069950 CET	49782	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:30.796670914 CET	49782	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:30.796701908 CET	443	49782	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:30.796785116 CET	443	49782	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:30.796799898 CET	49782	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:30.796818972 CET	443	49782	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:33.017321110 CET	49783	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:33.017376900 CET	443	49783	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:33.017532110 CET	49783	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:33.936094046 CET	49783	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:33.936126947 CET	443	49783	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:33.936176062 CET	443	49783	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:37.344707012 CET	49784	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:37.344784975 CET	443	49784	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:37.344861031 CET	49784	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:37.423747063 CET	49784	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:37.423770905 CET	443	49784	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:37.423818111 CET	49784	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:37.423832893 CET	443	49784	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:37.423835039 CET	443	49784	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:40.235837936 CET	49785	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:40.235871077 CET	443	49785	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:40.235964060 CET	49785	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:40.790370941 CET	49785	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:40.790394068 CET	443	49785	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:40.790447950 CET	443	49785	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:43.438896894 CET	49786	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:43.438949108 CET	443	49786	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:43.439047098 CET	49786	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:43.518181086 CET	49786	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:43.518205881 CET	443	49786	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:43.518254995 CET	443	49786	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:43.518260002 CET	49786	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:43.518273115 CET	443	49786	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:45.798039913 CET	49787	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:45.798101902 CET	443	49787	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:45.798175097 CET	49787	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:46.225598097 CET	49787	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:46.225632906 CET	443	49787	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:46.225693941 CET	443	49787	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.775198936 CET	49788	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:47.775248051 CET	443	49788	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.775331020 CET	49788	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:47.844104052 CET	49788	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:47.844136953 CET	443	49788	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.844197989 CET	49788	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:47.844204903 CET	443	49788	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.844223022 CET	443	49788	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.856332064 CET	49789	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:47.856378078 CET	443	49789	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:47.856445074 CET	49789	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:47.911056042 CET	49789	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:47.911094904 CET	443	49789	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:47.911164999 CET	49789	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:47.911171913 CET	443	49789	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:47.911185026 CET	443	49789	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:47.923841000 CET	49790	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:47.923902988 CET	443	49790	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:47.924021006 CET	49790	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:47.977304935 CET	49790	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:47.977333069 CET	443	49790	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:47.977349043 CET	49790	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:47.977358103 CET	443	49790	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:47.977402925 CET	443	49790	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:47.995564938 CET	49791	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:47.995676994 CET	443	49791	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:47.995774984 CET	49791	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:48.061526060 CET	49791	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:48.061570883 CET	443	49791	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:48.061638117 CET	443	49791	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:48.061640024 CET	49791	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:48.061667919 CET	443	49791	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:50.094768047 CET	49792	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:50.094814062 CET	443	49792	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:50.094894886 CET	49792	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:50.162548065 CET	49792	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:50.162595034 CET	443	49792	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:50.162652969 CET	443	49792	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:50.162687063 CET	49792	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:13:50.162714958 CET	443	49792	188.132.183.159	192.168.2.8
Dec 27, 2024 15:13:52.894560099 CET	49793	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:52.894606113 CET	443	49793	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:52.894682884 CET	49793	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:53.255486012 CET	49793	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:53.255515099 CET	443	49793	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:53.255561113 CET	49793	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:13:53.255567074 CET	443	49793	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:53.255578995 CET	443	49793	206.206.125.221	192.168.2.8
Dec 27, 2024 15:13:56.279958010 CET	49794	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:56.280004978 CET	443	49794	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:56.280118942 CET	49794	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:56.446944952 CET	49794	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:13:56.446964025 CET	443	49794	94.131.118.216	192.168.2.8
Dec 27, 2024 15:13:56.447021961 CET	443	49794	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:00.469459057 CET	49795	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:00.469494104 CET	443	49795	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:00.469582081 CET	49795	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:00.609757900 CET	49795	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:00.609788895 CET	443	49795	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:00.609874010 CET	443	49795	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:05.094593048 CET	49796	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:05.094644070 CET	443	49796	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:05.094835043 CET	49796	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:05.223567009 CET	49796	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:05.223614931 CET	443	49796	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:05.223654985 CET	443	49796	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:05.223659992 CET	49796	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:05.223678112 CET	443	49796	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:08.378609896 CET	49797	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:08.378664970 CET	443	49797	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:08.382783890 CET	49797	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:08.538851976 CET	49797	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:08.538881063 CET	443	49797	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:08.538954020 CET	443	49797	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:08.538992882 CET	49797	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:08.539015055 CET	443	49797	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:11.440877914 CET	49798	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:11.440943003 CET	443	49798	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:11.441004038 CET	49798	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:11.554996014 CET	49798	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:11.555032015 CET	443	49798	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:11.555073977 CET	49798	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:11.555085897 CET	443	49798	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:11.555093050 CET	443	49798	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:14.266637087 CET	49799	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.266735077 CET	443	49799	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.266998053 CET	49799	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.314157009 CET	49799	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.314157009 CET	49799	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.314209938 CET	443	49799	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.314248085 CET	443	49799	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.314404011 CET	443	49799	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.330621004 CET	49800	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.330688000 CET	443	49800	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.334753036 CET	49800	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.394622087 CET	49800	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.394645929 CET	443	49800	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.394793034 CET	443	49800	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.394819021 CET	49800	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.394835949 CET	443	49800	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.398617983 CET	49801	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:14.398664951 CET	443	49801	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:14.402899027 CET	49801	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:14.457175970 CET	49801	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:14.457192898 CET	443	49801	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:14.457268000 CET	443	49801	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:14.457313061 CET	49801	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:14.457324982 CET	443	49801	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:14.461057901 CET	49802	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:14.461119890 CET	443	49802	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:14.461241961 CET	49802	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:14.522655010 CET	49802	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:14.522746086 CET	443	49802	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:14.522922993 CET	443	49802	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:14.522969007 CET	49802	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:14.523006916 CET	443	49802	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:14.524885893 CET	49803	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.524949074 CET	443	49803	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.525158882 CET	49803	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.586617947 CET	49803	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:14.586651087 CET	443	49803	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:14.586769104 CET	443	49803	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:16.610656977 CET	49804	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:16.610706091 CET	443	49804	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:16.610923052 CET	49804	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:16.661948919 CET	49804	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:16.661948919 CET	49804	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:16.661966085 CET	443	49804	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:16.661973953 CET	443	49804	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:16.662050009 CET	443	49804	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:17.689659119 CET	49805	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:17.689790010 CET	443	49805	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:17.689879894 CET	49805	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:17.786587954 CET	49805	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:17.786664963 CET	443	49805	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:17.786714077 CET	49805	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:17.786736012 CET	443	49805	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:17.786881924 CET	443	49805	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:18.953897953 CET	49806	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:18.953943014 CET	443	49806	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:18.954700947 CET	49806	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:19.005779982 CET	49806	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:19.005825996 CET	443	49806	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:19.005873919 CET	49806	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:19.005896091 CET	443	49806	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:19.005901098 CET	443	49806	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:20.032051086 CET	49807	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:20.032104969 CET	443	49807	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:20.032191038 CET	49807	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:20.077033043 CET	49807	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:20.077049971 CET	443	49807	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:20.077127934 CET	49807	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:20.077167988 CET	443	49807	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:22.110197067 CET	49808	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:22.110230923 CET	443	49808	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:22.110317945 CET	49808	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:22.152926922 CET	49808	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:22.152947903 CET	443	49808	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:22.153009892 CET	49808	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:22.153023958 CET	443	49808	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:22.153023958 CET	443	49808	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:23.172622919 CET	49809	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:23.172667980 CET	443	49809	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:23.172827959 CET	49809	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:23.229408026 CET	49809	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:23.229444027 CET	443	49809	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:23.229492903 CET	49809	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:23.229491949 CET	443	49809	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:23.229506016 CET	443	49809	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:24.250968933 CET	49810	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:24.251017094 CET	443	49810	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:24.251249075 CET	49810	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:24.310652018 CET	49810	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:24.310676098 CET	443	49810	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:24.310713053 CET	443	49810	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:25.329219103 CET	49811	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.329272032 CET	443	49811	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.329332113 CET	49811	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.397670984 CET	49811	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.397708893 CET	443	49811	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.397743940 CET	443	49811	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.397754908 CET	49811	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.397769928 CET	443	49811	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.417298079 CET	49812	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.417324066 CET	443	49812	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.417444944 CET	49812	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.488342047 CET	49812	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.488354921 CET	443	49812	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.488399029 CET	443	49812	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.488406897 CET	49812	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.488419056 CET	443	49812	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.492177963 CET	49813	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:25.492228985 CET	443	49813	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:25.492336988 CET	49813	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:25.542643070 CET	49813	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:25.542643070 CET	49813	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:25.542679071 CET	443	49813	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:25.542690992 CET	443	49813	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:25.542718887 CET	443	49813	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:25.546514988 CET	49814	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:25.546587944 CET	443	49814	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:25.546663046 CET	49814	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:25.643862009 CET	49814	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:25.643898964 CET	443	49814	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:25.643934965 CET	443	49814	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:25.643943071 CET	49814	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:25.643965006 CET	443	49814	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:25.646868944 CET	49815	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.646912098 CET	443	49815	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.646969080 CET	49815	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.687386036 CET	49815	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.687417030 CET	443	49815	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.687450886 CET	443	49815	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:25.687480927 CET	49815	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:25.687498093 CET	443	49815	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:27.719443083 CET	49816	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:27.719494104 CET	443	49816	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:27.719608068 CET	49816	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:27.771286964 CET	49816	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:27.771301985 CET	443	49816	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:27.771338940 CET	443	49816	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:27.771377087 CET	49816	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:27.771387100 CET	443	49816	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:28.800822020 CET	49817	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:28.800856113 CET	443	49817	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:28.800975084 CET	49817	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:28.864984035 CET	49817	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:28.865008116 CET	443	49817	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:28.865046024 CET	443	49817	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:28.865135908 CET	49817	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:28.865154982 CET	443	49817	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:29.954159021 CET	49818	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:29.954210997 CET	443	49818	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:29.954288960 CET	49818	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:30.031928062 CET	49818	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:30.031944990 CET	443	49818	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:30.031979084 CET	443	49818	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:30.032008886 CET	49818	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:30.032026052 CET	443	49818	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:31.066678047 CET	49819	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:31.066715956 CET	443	49819	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:31.066848040 CET	49819	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:31.113342047 CET	49819	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:31.113363981 CET	443	49819	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:31.113414049 CET	443	49819	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:33.159084082 CET	49820	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:33.159130096 CET	443	49820	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:33.159732103 CET	49820	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:33.237271070 CET	49820	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:33.237288952 CET	443	49820	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:33.237344027 CET	443	49820	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:33.237360954 CET	49820	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:33.237370014 CET	443	49820	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:34.266690016 CET	49821	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:34.266741037 CET	443	49821	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:34.266973019 CET	49821	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:34.306736946 CET	49821	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:34.306765079 CET	443	49821	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:34.306814909 CET	443	49821	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:35.329721928 CET	49822	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:35.329750061 CET	443	49822	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:35.329827070 CET	49822	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:35.408401012 CET	49822	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:35.408416033 CET	443	49822	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:35.408467054 CET	443	49822	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:35.408471107 CET	49822	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:35.408482075 CET	443	49822	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:36.438139915 CET	49823	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.438193083 CET	443	49823	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.438771009 CET	49823	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.495767117 CET	49823	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.495767117 CET	49823	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.495793104 CET	443	49823	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.495804071 CET	443	49823	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.495836973 CET	443	49823	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.516731024 CET	49824	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.516778946 CET	443	49824	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.517098904 CET	49824	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.568557978 CET	49824	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:36.568583012 CET	443	49824	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.568629026 CET	443	49824	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:36.571415901 CET	49825	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:36.571464062 CET	443	49825	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:36.571638107 CET	49825	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:36.617225885 CET	49825	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:36.617243052 CET	443	49825	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:36.617280960 CET	443	49825	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:36.622392893 CET	49826	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:36.622440100 CET	443	49826	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:36.624897003 CET	49826	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:37.705534935 CET	49826	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:37.705570936 CET	443	49826	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:37.705650091 CET	49826	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:37.705657005 CET	443	49826	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:37.705705881 CET	443	49826	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:37.708957911 CET	49827	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:37.708998919 CET	443	49827	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:37.709059954 CET	49827	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:37.750730991 CET	49827	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:37.750747919 CET	443	49827	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:37.750791073 CET	443	49827	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:37.750907898 CET	49827	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:37.750921011 CET	443	49827	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:39.782598019 CET	49828	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:39.782655954 CET	443	49828	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:39.783277035 CET	49828	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:39.835892916 CET	49828	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:39.835892916 CET	49828	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:39.835922956 CET	443	49828	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:39.835936069 CET	443	49828	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:39.835988998 CET	443	49828	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:40.860122919 CET	49829	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:40.860172033 CET	443	49829	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:40.860363960 CET	49829	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:40.907983065 CET	49829	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:40.908014059 CET	443	49829	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:40.908058882 CET	443	49829	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:40.908092976 CET	49829	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:40.908109903 CET	443	49829	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:41.985187054 CET	49830	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:41.985256910 CET	443	49830	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:41.985369921 CET	49830	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:42.051197052 CET	49830	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:42.051234961 CET	443	49830	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:42.051282883 CET	49830	443	192.168.2.8	94.131.118.216
Dec 27, 2024 15:14:42.051289082 CET	443	49830	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:42.051320076 CET	443	49830	94.131.118.216	192.168.2.8
Dec 27, 2024 15:14:43.112747908 CET	49831	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:43.112804890 CET	443	49831	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:43.116877079 CET	49831	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:43.156600952 CET	49831	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:43.156621933 CET	443	49831	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:43.156702042 CET	443	49831	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:45.188322067 CET	49832	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:45.188375950 CET	443	49832	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:45.188520908 CET	49832	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:45.236366987 CET	49832	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:45.236402988 CET	443	49832	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:45.236445904 CET	49832	443	192.168.2.8	188.132.183.159
Dec 27, 2024 15:14:45.236450911 CET	443	49832	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:45.236462116 CET	443	49832	188.132.183.159	192.168.2.8
Dec 27, 2024 15:14:46.281722069 CET	49833	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:46.281785011 CET	443	49833	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:46.282152891 CET	49833	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:46.361208916 CET	49833	443	192.168.2.8	206.206.125.221
Dec 27, 2024 15:14:46.361258030 CET	443	49833	206.206.125.221	192.168.2.8
Dec 27, 2024 15:14:46.361332893 CET	443	49833	206.206.125.221	192.168.2.8

Target ID:	0
Start time:	09:10:38
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\TeikwYB2tm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\TeikwYB2tm.exe"
Imagebase:	0x400000
File size:	4'277'248 bytes
MD5 hash:	72B6B07175EF611CE7DAA959A1248AAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 00000000.00000003.1461746812.000000007E960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:10:42
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:10:42
Start date:	27/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	09:10:42
Start date:	27/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic diskdrive where "DeviceID=\'c:\'" get SerialNumber /value
Imagebase:	0xa30000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true